CVE-2022-39884: Improper Access Control Vulnerability in IImsService Prior to SMR Nov-2022 Release 1 Allows Local Attacker to Gain Access to Call Information

CVE-2022-39884 describes an improper access control vulnerability in IImsService, a service that handles voice call state and related information, discovered in devices prior to the SMR Nov-2022 Release 1. An attacker can potentially exploit the vulnerability to gain unauthorized access to call information (such as phone numbers, call state, and duration) without user consent or authentication. This post will provide a brief overview of this vulnerability, a code snippet demonstrating the issue, and links to original references to help developers patch the vulnerability in the IImsService implementation.

Background on IImsService

IImsService is an essential component of modern smartphone telecommunication stacks, providing a centralized interface for managing voice calls and related information. The service is typically implemented as an Android service, and developers use public APIs to interact with the IImsService. The system is designed to properly manage access control, ensuring that only authorized applications or system components can access call-related information.

Affected Versions: Devices Prior to SMR Nov-2022 Release 1

- Impact: Local attacker can gain access to call information without user consent or proper authentication

The vulnerability exists in the IImsService component, where improper access control checks could allow an unauthorized application or component to access call information, such as phone numbers, call state, and call duration. This can lead to a potential privacy leak, where an attacker with local access to the device can spy on call details without the user's knowledge or consent.

Code Snippet

Below is a simplified example that demonstrates the access control vulnerability. In this code snippet, the onCallStateChanged callback does not adequately check the caller's permissions before providing access to critical call information:

public class IImsServiceSample extends Service {
    ...
    @Override
    public void onCallStateChanged(int state, String number) {
        // Missing access control check
        for (IImsServiceListener listener : mListeners) {
            try {
                listener.onCallStateChanged(state, number);
            } catch (RemoteException e) {
                Log.e(TAG, "Error notifying listener", e);
            }
        }
    }
    ...
}

In the code snippet above, the onCallStateChanged method fails to check the caller's permissions, which could enable unauthorized access to the call state and the phone number involved in the call.

Exploit

To exploit this vulnerability, an attacker needs to have local access to the device (e.g., an installed app with the necessary permissions to access the IImsService). The attacker can then implement a listener to receive call state changes and call information.

Recommendations and References

To mitigate this vulnerability, developers should ensure proper access control is in place when implementing the IImsService component, utilizing Android's permission model, and checking authorized callers before granting access to sensitive information.

For more information about IImsService and Android's permission model, refer to the following resources:

- Android Developers: Working with System Permissions
- Android Open Source Project: Telephony

If you think your device may be affected by this vulnerability, please consult with your device manufacturer for available security updates.

Stay safe, and ensure that your applications and services are protected against potential vulnerabilities. Keep an eye out for updates and patches to stay ahead of potential threats.

Timeline

Published on: 11/09/2022 22:15:00 UTC
Last modified on: 11/10/2022 15:22:00 UTC